OFFICE OF AUDITOR OF STATE STATE OF IOWA Rob Sand Auditor of State State Capitol Building Des Moines, Iowa 50319-0006 Telephone (515) 281-5834 Facsimile (515) 281-6518 NEWS RELEASE FOR RELEASE August 22, 2019 Contact: Rob Sand 515/281-5835 or Annette Campbell 515/281-5834 Auditor of State Rob Sand today released a report on a special investigation of the Department of Public Safety (DPS) for the period July 1, 2016 through August 15, 2018. The special investigation was requested by DPS officials as a result of concerns regarding certain applications processed by the former Clerk Specialist, Joe Sheehan Jr. Mr. Sheehan was placed on leave on August 16, 2018 and terminated from his position on November 6, 2018. Sand reported the special investigation identified Mr. Sheehan was responsible for ensuring appropriate procedures were performed prior to issuing licenses to individuals who applied for private investigator, private security, and/or bail enforcement licenses. Appropriate procedures include conducting an Iowa background check and a nationwide background check. However, because sufficient documentation was not maintained, it was not possible to determine if Mr. Sheehan performed Iowa background checks prior to issuing provisional licenses. Sand also reported, using documentation from an outside source, it was determined 5,817 licenses were issued between July 1, 2016 and August 15, 2018 without a nationwide background check. Sand reported it is possible nationwide background checks may have been processed in late August or September 2018 for a limited number of the guard cards issued near the end of the period tested. Sand also reported, based on procedures performed by a DPS official in August 2019, the validity of 869 licenses was still pending. In addition, Sand reported Mr. Sheehan was responsible for collecting fees associated with the licenses and depositing them with DPS administrative staff. However, sufficient records were not available to compare collections received to collections recorded for the licenses. As a result, it was not possible to determine if all collections received were properly deposited. The report includes recommendations to strengthen DPS’ internal controls, including segregating duties, maintain supporting documentation, and implementing procedures to properly account for numerical sequence of licenses issued. In addition, the report includes recommendations to implement policies and procedures to ensure licenses are properly processed. Copies of this report have been filed with the Polk County Attorney’s Office, Division of Criminal Investigation, and the Attorney General’s Office. A copy of the report is available for review on the Auditor of State’s web site at https://auditor.iowa.gov/reports/audit-reports/. ### REPORT ON SPECIAL INVESTIGATION OF THE DEPARTMENT OF PUBLIC SAFETY FOR THE PERIOD JULY 1, 2016 THROUGH AUGUST 15, 2018 1960-5950-0E00 Table of Contents Page Auditor of State’s Report 3-4 Investigative Summary: Background Information Detailed Findings Recommended Control Procedures 5-8 9-14 15-18 Exhibit: Number of Applications Processed by Fiscal Year Staff Exhibit A 21-22 23 2 OFFICE OF AUDITOR OF STATE STATE OF IOWA State Capital Building Des Moines, Iowa 50319-0004 Telephone (515) 281-5834 Rob Sand Auditor of State Facsimile (515) 281-6518 Auditor of State’s Report To the Stephan Bayens, Commissioner of the Iowa Department of Public Safety: As a result of concerns identified regarding certain financial transactions processed by a former Clerk Specialist and at the request of Department of Public Safety (DPS) officials, we have applied certain tests and procedures to selected financial transactions of the Department for the period July 1, 2016 through August 15, 2018. Based on a review of relevant information and discussions with DPS officials and personnel, we performed the following procedures. (1) Evaluated internal controls to determine whether adequate policies and procedures were in place and operating effectively. (2) Obtained an understanding of the process followed by a former Clerk Specialist for receiving and depositing payments related to private investigator, private security, and bail enforcement security licenses. We also obtained an understanding of the process followed to determine if a license should be issued to an applicant. (3) Reviewed activity in certain accounts established within the State’s I3 accounting system (I3 accounts) to identify any unusual activity and examined certain deposits to the I3 accounts to determine the source, purpose, and propriety of the deposits. (4) Compared collections recorded for private investigator, private security, and bail enforcement licenses in the Private Investigator/Private Security (PIPS) system to those recorded in the I3 accounts to determine if all collections were properly remitted to the State Treasurer. (5) Examined statements issued to DPS by the FBI to determine the number of background checks performed for individuals applying for private investigator, private security, and bail enforcement licenses. We also compared the number of FBI background checks performed to the number of licenses issued to determine how many licenses were issued without a nationwide background check. (6) Compared the number of FBI background checks performed to the number of nationwide background checks recorded as performed in the Private Investigator/ Private Security/Bail Enforcement (PIPSBE) system to determine the propriety of the information recorded in PIPSBE. (7) Analyzed information recorded in PIPSBE to determine if appropriate oversight was performed to ensure compliance with DPS procedures. Because sufficient documentation was not maintained, it was not possible to determine if Mr. Sheehan performed Iowa background checks prior to issuing provisional licenses. However, these procedures identified 5,817 licenses were issued between July 1, 2016 and August 15, 2018 without a nationwide background check. It is possible nationwide background checks may have been processed in late August or September 2018 for a limited number of the guard cards issued near the end of the period tested. 3 In addition, the procedures identified sufficient records were not available to compare collections received to collections recorded for all types of licenses. As a result, we were unable to determine if all collections received were properly deposited. Several internal control weaknesses were also identified. Our detailed findings and recommendations are presented in the Investigative Summary of this report. The procedures described above do not constitute an audit of financial statements conducted in accordance with U.S. generally accepted auditing standards. Had we performed additional procedures, or had we performed an audit of financial statements of the Program Services Bureau of the Department of Public Safety, other matters might have come to our attention that would have been reported to you. Copies of this report have been filed with the Polk County Attorney’s Officer, Division of Criminal Investigation, and the Attorney General’s Office. We would like to acknowledge the assistance extended to us by officials and personnel of the Department of Public Safety during the course of our investigation. Rob Sand Auditor of State August 16, 2019 4 Report on Special Investigation of the Department of Public Safety Investigative Summary Background Information The Administrative Services Division of Iowa Department of Public Safety (DPS) provides support services to the remaining 5 Divisions of DPS as well as direct services to criminal justice agencies statewide and to the citizens of Iowa. The Division of Administrative Services is comprised of 3 bureaus, including Program Services, Technology Services, and Finance. The Program Services Bureau administers Private Security/Private Investigator/Bail Enforcement Agency Licensing, Weapons Permits, and the Uniform Crime Reporting System. According to section 661-121.1 of the Iowa Administrative Code, the Administrative Services Division shall administer the bail enforcement, private investigation, and private security statute. As a result, applications for a license for these functions are obtained from the Program Services Bureau. In accordance with section 80A.3 of the Code of Iowa, “a person shall not operate a bail enforcement business, private investigation business, or private security business, or otherwise employ persons in the operation of such a business located within this state unless the person is licensed by the [Public Safety] commissioner.” The licenses for these agencies expire 2 years after the date of issuance. Joe Sheehan Jr. began employment with DPS as a temporary Clerk Specialist in the Program Services Bureau on December 6, 2004. He became a permanent full time employee on April 8, 2005 and continued to be employed by DPS until November 6, 2018. As a Clerk Specialist in the Program Services Bureau, Mr. Sheehan was responsible for the issuance of licenses to private investigation, private security, and bail enforcement agencies and individuals employed by the agencies. The 3 types of licenses issued to individuals are commonly referred to as “guard cards” by DPS staff. Specifically, Mr. Sheehan was responsible for:  Opening the mail;  Recording payments for applications and licensing fees received from agencies for which drawdown accounts were established in the Private Investigator/Private Security (PIPS) system (an electronic spreadsheet);  Reviewing applications for completeness;  Entering application data in the Private Investigator/Private Security/Bail Enforcement (PIPSBE) system for the issuance of guard cards;  Completing an initial background check;  Sending fingerprint cards to Division of Criminal Investigation (DCI) to forward to the Federal Bureau of Investigation (FBI) for nationwide background checks of individuals who pass the initial background check;  Recording subsequent disposition of nationwide background checks (i.e. pass or did not pass) into the PIPSBE system. In addition, if an individual did not pass the background check, he was to send a letter to the employing agency notifying them. Application Process – Applications must be completed for all agencies wishing to obtain their license for bail enforcement, private investigation, and/or private security. As specified on the application, the fee is $100.00 per license for the agency. In addition to completing the application, 2 fingerprint cards are required for the individual completing the agency application and 2 color photos of the applicant are required. There is a $30.00 fee for fingerprints and a $10.00 fee for the application. All fees must be paid to DPS before the application will be processed. 5 Agencies must also submit a copy of a surety bond that covers the agency. As specified on the application, the surety bond must be at least $5,000 for a single type of license; however, if the agency would like more than a single license, such as a private security license and a private investigation license, the surety bond amount is required to be at least $10,000. In addition to the surety bond, the agency applicant must provide proof of liability insurance. Also, pictures, photo copies, or physical descriptions of all uniforms, badges, insignia, patches, and hats must be submitted for approval. After the agency’s application has been approved and the agency has received their license for bail enforcement, private investigation, and/or private security services, the agency may begin providing services; however, employees of these agencies must also obtain individual guard cards from DPS. Individuals wishing to provide private investigator, private security, or bail enforcement services for a licensed agency must complete an application. In addition, all applicants must be employed by a licensed agency in order to be eligible for a guard card. License applications for individuals are available at a cost of $15.00 by mail or $10.00 if obtained at DPS. Applications may be purchased by individuals applying for a guard card or they may be purchased by the licensed agencies who plan to employ the individuals. An agency may purchase several applications from DPS in advance to have on hand and provide to potential employees rather than having the employees purchase them individually from DPS. The individuals must complete the application and have fingerprints taken which cost $30.00 in addition to the application fee. The fee must be submitted to DPS before the application is processed. Payment Process – Payments for application fees and fingerprint cards from agencies and individuals may be paid to DPS by either cash or check. DPS also allows agencies to establish a drawdown account. A drawdown account is created when an agency provides DPS an initial deposit of money. After establishing the drawdown account, fees for applications purchased by the agency and fees for processing fingerprint cards are deducted from the drawdown account until the balance is insufficient to pay the fees. Once the balance is insufficient, DPS must inform the agency they need to deposit additional funds into the drawdown account. Monthly and/or quarterly statements are not provided to the agencies so the agencies are unable to verify the accuracy or monitor their account balances. Drawdowns from the agencies’ accounts were performed by Mr. Sheehan; however, supporting documentation was not available to determine the accuracy of the drawdowns. In addition, an independent person performs a monthly reconciliation of the activity in the drawdown accounts; however, the individual performing the reconciliation does not receive any report or supporting documentation to ensure the proper amount is drawn down from an agency’s account. The type of funds (cash, check, or drawdown) collected by DPS for the application and fingerprint cards was to be recorded by Mr. Sheehan in PIPS, which is a designated electronic spreadsheet for guard card fees, and the funds collected were to be provided to an accountant within DPS. Guard card issuance – Mr. Sheehan was responsible for entering the application in the Private Investigator/Private Security/Bail Enforcement (PIPSBE) software maintained by DPS. He was also responsible for performing an Iowa background check on each applicant. If the Iowa background check did not identify any concerns, Mr. Sheehan was to issue a provisional guard card. However, if something was identified by the background check, the guard card was to be denied and not issued. Provisional guard cards are sent to the agency which employs the applicant. In addition, the provisional guard cards specify the agency employing the applicant. The guard cards are valid only while the license holder is employed by the agency specified on the guard card issued by DPS. Guard card do not have an expiration date. As a result, a licensee can maintain an active license until the applicant leaves employment of the agency specified on their license or the employer notifies DPS officials of any violations which can result in revocation of the license. The preprinted license number on each guard card agrees with the related application number. 6 Mr. Sheehan was responsible for documenting whether the provisional guard card was approved or denied in PIPSBE. After the successful completion of the Iowa background check, Mr. Sheehan was responsible for sending the fingerprint cards to the DCI so a nationwide background check could be completed by the FBI. In accordance with section 661-121.2(80A) of the Iowa Administrative Code, a background investigation shall include the submission of fingerprints of the applicant to the FBI for a nationwide criminal history record check. The nationwide background checks usually took approximately 2 weeks to complete. Once they were completed, the DCI received a report with the results from the FBI. The report was provided to Mr. Sheehan who was responsible for documenting the date of the nationwide background check in the PIPSBE software and updating any guard card status based on the applicant’s background. At the end of each month, FBI sent an invoice to the DCI for the cost of performing the nationwide background checks. A payment was then to be generated to the FBI. If there was something identified in the nationwide background check, the applicant’s guard card was to be revoked and a letter was sent to the applicant’s employer to notify them of the voided guard card. In addition, in accordance with section 661-121.9(80A) of the Iowa Administrative Code, the original guard card was to be returned to the Administrative Services Division within 7 days of receipt of the letter. We determined DPS has not established a process to ensure denied or revoked guard cards are returned by the agencies in a timely manner. As a result, individuals may improperly use a revoked license. Use of Guard Cards – In accordance with section 80A.1 of the Code of Iowa, the purpose of private investigation, private security, and bail enforcement businesses are as follows:   Private investigation – investigating for purpose of obtaining information on any of the following matters: o Crime or wrongs done or threatened. o The habits, conduct, movements, whereabouts, associations, transactions, reputations, or character of a person. o The credibility of witnesses or other persons. o The location or recovery of lost or stolen property. o The cause, origin, or responsibility for fires, accidents, or injuries to property. o Detection of deceptions. o The business of securing evidence to be used before authorized investigating committees, boards or award or arbitration, or in the trial of civil or criminal cases. Private security – furnishing guards, watch personnel, armored car personnel, patrol personnel, or other persons to: o protect persons or property, o prevent the unlawful taking of goods and merchandise, or o prevent the misappropriation or concealment of goods, merchandise, money, securities, or other valuable documents or papers. Private security also includes furnishing an individual who patrols, watches, or guards a residential, industrial, or business property or district. 7  Bail enforcement – taking or attempting to take into custody the principal on a bail bond issued or a deposit filed in relation to a criminal proceeding to assure the presence of the defendant at trial. However, bail enforcement does not include actions undertaken by a peace officer or a law enforcement officer in the course of the officer’s official duties. It is not unusual for individuals employed in the areas of private investigations, private security, and/or bail enforcement to carry a weapon. However, Chapter 80A does not address weapons permits for individuals who obtain guard cards. Individuals who wish to carry a weapon are required to apply for the appropriate permit in accordance with Chapter 724 of the Code. Individuals deemed eligible for private investigations, private security, and bail enforcement licenses are not automatically granted the authority to carry a weapon. Concerns Identified – As stated previously, guard cards are not linked to weapons permits. However, on August 14, 2018, the Linn County Sheriff’s Office (Sheriff’s Office) received an application for a weapons permit from an individual who had an extensive history of criminal convictions outside of Iowa which should have prevented him from obtaining a guard card. However, the individual held an active guard card. As a result, a representative of the Sheriff’s Office called a DCI agent to determine why the individual had not been denied a guard card. As a result of the concern brought to his attention, the DCI agent contacted Mr. Sheehan and requested he pull the individual’s file and provide it to the Bureau Chief of the Program Services Bureau for his review. The Bureau Chief has since left DPS’ employment. On August 15, 2018, the DCI agent called the former Bureau Chief to discuss the concern identified; however, the former Bureau Chief stated he had not received the file from Mr. Sheehan. The former Bureau Chief promptly obtained the file from Mr. Sheehan and started to review the information it contained. The former Bureau Chief determined Mr. Sheehan had recorded in the PIPSBE system he had submitted the individual’s fingerprint card to DCI on May 3, 2018; however, there was a note on the fingerprint card in the file saying it was sent to DCI on August 15, 2018. As a result, it was apparent the date Mr. Sheehan recorded in PIPSBE was incorrect. Because of the discrepancies regarding the dates in the PIPSBE system and because a guard card appeared to have been improperly activated, the former Bureau Chief reviewed applications processed by Mr. Sheehan on May 2, 2018 and May 3, 2018 to determine if it was an isolated incident. According to the former Bureau Chief, he determined 70 guard cards were processed for these 2 days but 41 of the 70 cards did not have fingerprint cards submitted to DCI. To determine if fingerprint cards were not properly submitted a year prior to this period, the former Bureau Chief expanded his review and reviewed applications processed by Mr. Sheehan on May 2, 2017 and May 3, 2017. He determined there were 60 provisional guard cards issued on these days. As a result, a minimum of 60 fingerprint cards should have been submitted to DCI. To expedite his review, he selected 10 of the 60 guard cards to trace to a fingerprint card submitted to DCI. The former Bureau Chief stated he determined information recorded in PIPSBE for 9 of the 10 guard cards selected for testing did not include a date fingerprint cards were submitted to DCI. As a result, it appeared nationwide background checks had not been performed and the provisional guard cards issued to the 9 applicants had been improperly activated. Due to the concerns identified by the former Bureau Chief, Mr. Sheehan was placed on paid administrative leave on August 16, 2018. On August 22, 2018, the Office of Auditor of State was notified of the irregularities. As a result, we performed procedures detailed in the Auditor of State’s report for the period July 1, 2016 through August 15, 2018. On November 6, 2018, Mr. Sheehan was terminated from employment. 8 Detailed Findings Because sufficient documentation was not maintained, it was not possible to determine if Mr. Sheehan performed Iowa background checks prior to issuing provisional licenses. However, using documentation obtained from the FBI, the procedures identified 5,817 licenses were issued between July 1, 2016 and August 15, 2018 without a nationwide background check. It is possible nationwide background checks may have been processed in late August or September 2018 for a limited number of the guard cards issued near the end of the period tested. In addition, we were unable to determine if all collections received were properly deposited because sufficient records were not available to compare collections received to collections recorded for all types of licenses. Several internal control weaknesses were also identified. A detailed explanation of each finding follows. Undeposited Collections – As previously stated, Mr. Sheehan was responsible for issuing guard cards and collecting and recording funds received from the guard card applications and fingerprint cards. However, Mr. Sheehan did not prepare an initial receipt listing or otherwise record the amounts he collected at the time he opened the mail or the collections were otherwise provided to him. Because receipts were not prepared for collections or recorded on an initial receipt listing, we obtained other documentation maintained by DPS to determine if fees collected for the guard cards were properly deposited. We reviewed PIPSBE reports to obtain the number of guard cards issued from July 1, 2016 through August 15, 2018 and compared that information to the amount of application fees collected to determine if all transactions were properly recorded and deposited. However, we determined sufficient information was not maintained by DPS to determine the amount of collections DPS received from agencies and individuals for application and fees for processing fingerprint cards. Specifically, the ledgers maintained for the drawdown accounts lacked detailed transaction history which prevented us from matching amounts withdrawn from accounts to applications issued by DPS. In addition, we identified agencies which sent in checks for applications and, instead of recording the deposit of the check in the drawdown account and then showing the withdrawal for applications, DPS staff deposited the check with application fees and fingerprint card fees and mailed out the applications. Also, sufficient information was not maintained for application fees paid by individuals or agencies who had not established a drawdown account. During our review, we also obtained and reviewed reconciliations performed by DPS personnel using information from PIPS to determine if all collections received for applications and fingerprint cards were properly deposited. However, we determined the reconciliations included only collections received through drawdown accounts and did not include collections from other sources. As a result, we were unable to compare all collections received to collections recorded. During our review of monthly reconciliations, we also identified several transactions backdated after the monthly reconciliation was performed. According to a DPS representative, employees have been instructed on a number of occasions not to backdate transactions in PIPS to ensure all income is properly recognized in the proper reporting period. In addition, once the monthly reconciliation was completed for the month, there is no further review of the PIPS access database transactions for that month. Because we were unable to compare collections received to collections recorded for all types of guard cards, we were unable to determine if all collections received were properly recorded. Application Tracking – As previously stated, applications for private investigator, private security, and bail enforcement licenses are provided at a cost of $10.00 or $15.00. Some of the applications are submitted to DPS by the applicant immediately after purchase, some are 9 submitted at a later date, and some have yet to be submitted. The applications are prenumbered and the application numbers are used as the guard card/license numbers. During our review, we determined DPS officials were not accounting for numerical sequence of the applications. As a result, DPS officials were unable to determine if an application was ever returned and if it was returned, whether it was for a private investigator, private security, and/or bail enforcement license. If this information had been maintained, sufficient information would have been available to determine if the collections deposited by DPS for the licenses appeared complete. Improperly Issued Guard Cards – While we were unable to determine if fees collected for guard cards was comparable to the number of guard cards issued due to lack of sufficient detailed collection information, we were able to compare the number of guard cards issued based on information recorded in the PIPSBE system to monthly billing statements which identified the number of fingerprint cards processed by the FBI for the period July 1, 2016 through August 15, 2018. Table 1 summarizes the number of guard cards issued compared to the number of fingerprint cards processed by the FBI. Table 1 Fiscal Year Description Guard cards issued 06/30/17 06/30/18 06/30/19* Total 4,111 3,205 460 7,776 910 931 118 1,959 Guard cards issued without nationwide background check 3,201 2,274 342 5,817 Percent of issued cards 77.9% 71.0% 74.3% 74.8% Fingerprint cards * - Through August 15, 2018 As illustrated by the Table, we identified 7,776 guard cards issued for the period July 1, 2016 through August 15, 2018. However, only 1,959 fingerprint cards were sent to FBI during the same period for a nationwide background check. A nationwide background check was not performed for the remaining 5,817 guard cards. However, it is possible fingerprint cards may have been processed in late August or September 2018 for a limited number of the guard cards issued near the end of the period tested. Also as illustrated by Table 1, we determined approximately 75% of the guard cards issued for the period tested were issued without the appropriate nationwide background check being performed. As previously stated, an Iowa background check must be performed for each guard card applicant and a nationwide background check must be performed for those who pass the Iowa background check. In addition, Mr. Sheehan was responsible for submitting fingerprint cards to the DCI for the nationwide background check. However, 5,817 guard cards were issued without a nationwide background check. Table 1 also illustrates 3,201 of the 5,817 guard cards issued without a nationwide background check were issued during the fiscal year ended June 30, 2017. Because a significant portion of the variance identified happened during the first fiscal year of our testing period, we believe we would have identified additional guard cards issued without a nationwide background check if we had extended testing to the period prior to July 1, 2016. Because we did not extend testing, we are unable to determine when Mr. Sheehan began issuing guard cards without performing the appropriate nationwide background checks. In addition, because sufficient documentation was not maintained, we are unable to determine if Mr. Sheehan performed all appropriate Iowa background checks which were to be performed prior to issuing a provisional guard card. 10 Reports from FBI – In addition to submitting the fingerprint cards to the DCI, Mr. Sheehan was responsible for entering the dates the fingerprint cards were submitted to the DCI into the PIPSBE system. After the fingerprint cards have been processed, DCI receives an FBI Identification Applicant Response Report (report) which contains the name of the applicant, tracking number, FBI number, state identification number, and the application number. The reports also state whether an FBI record was found for the applicant (which makes them ineligible for a guard card) or an FBI record was not found for the applicant. Mr. Sheehan was responsible for recording the date the nationwide background check was completed in the PIPSBE system for each applicant and the results. After Mr. Sheehan was placed on leave, the former Bureau Chief discovered 2 FBI reports for May 21, 2018 when he was going through Mr. Sheehan’s desk. When the former Bureau Chief compared the 2 FBI reports, he identified names in common between the 2 reports. He also determined certain names were not included on both reports and the formatting between the reports was different, including the font, placement of the FBI logo in the heading, and a footnote disclosure. In addition, while the former Bureau Chief was reviewing Mr. Sheehan’s computer, he discovered a Microsoft Word® document which included names of applicants which matched the FBI reports dated May 21, 2018. According to the former Bureau Chief, there would not be a reason for Mr. Sheehan to have the document on his computer. Because the former Bureau Chief was concerned about the differences identified on the 2 reports dated May 21, 2018, he showed them to a DCI representative. According to the former Bureau Chief, the DCI representative reported there would not be 2 reports from the FBI dated the same day. In addition, and one of the reports was formatted differently; therefore, one of the reports was not authentic. Propriety of PIPSBE Information – As previously stated, Mr. Sheehan was responsible for entering information into PIPSBE, such as dates for nationwide background checks. We reviewed the data entered for the applications processed for the period July 1, 2016 through August 15, 2018. During our review, we determined the PIPSBE system showed 6,661 fingerprints cards were submitted to the DCI for the nationwide background checks to be performed by the FBI. However, as previously stated, only 1,959 fingerprint cards were processed by FBI for nationwide background checks. Exhibit A lists the number of applications processed by Mr. Sheehan by fiscal year using information obtained from PIPSBE for the period July 1, 2016 through August 15, 2018. The Exhibit also illustrates how many of the applications were denied and how many guard cards were issued each fiscal year. Of the guard cards issued, the Exhibit includes the number of licenses which were voided, revoked, or suspended and the number of licenses which remained valid. Table 2 summarizes the information listed in Exhibit A in total for the period July 1, 2016 through August 15, 2018. Table 2 Fingerprint Cards Submitted per PIPSBE Description Yes* No Number of Guard Cards: Valid Void Revoked Suspended Guard cards issued Denied applications 4,350 2,307 3 1 6,661 - 799 313 2 1 1,115 197 5,149 2,620 5 2 7,776 197 6,661 1,312 7,973 Total applications Total * - Yes in the PIPSBE system indicates a fingerprint card was submitted to DCI. 11 As illustrated by the Table, information recorded in PIPSBE showed the following:  197 applicants were denied a guard card. Applicants are denied guard cards when they are unable to successfully pass the Iowa background check. PIPSBE showed a fingerprint card was not submitted to DCI for any of these applicants, which would be appropriate.  7,776 guard cards were issued to applicants. However, PIPSBE shows a fingerprint card was not submitted to the DCI for 1,115 of these applicants. As previously stated, a fingerprint card should be submitted to the DCI for each provisional guard card issued. If someone who was not involved in recording information in PIPSBE had compared the number of guard cards issued to the number of guard cards for which PIPSBE showed a fingerprint card had not been submitted to the DCI, some of the improperly issued guard cards may have been identified in a more timely manner. Table 2 also illustrates for the 7,776 provisional guard cards issued:  2,620 guard cards were voided after issuance as a result of the license holder leaving the employment of the licensed agency listed on their license.  5 guard cards were revoked after issuance because DPS learned of an infraction which made the license holder ineligible for a guard card.  2 guard cards were suspended after issuance because DPS learned of a pending investigation of an infraction which may make the license holder ineligible for a guard card.  The remaining 5,149 guard cards issued were valid. However, of these licenses, PIPSBE shows fingerprint cards were not sent to DCI for a nationwide background check for 799 of the license holders. As previously stated, if someone who was not involved in recording information in PIPSBE had compared the number of guard cards issued to the number of guard cards for which PIPSBE showed a fingerprint card had not been submitted to the DCI, some of the improperly issued guard cards may have been identified in a more timely manner. Table 3 summarizes the percent of the guard cards recorded in PIPSBE for which it was recorded fingerprint cards were and were not submitted to DCI. As illustrated by the Table, over 10% of the guard cards recorded in PIPSBE for fiscal years 2017 and 2018 showed fingerprint cards had not been submitted even though a guard card was issued to an applicant. Table 3 Number of Fingerprint Cards Submitted per PIPSBE System for Guard Cards Issued Fiscal Year Ended Yes No Number Percent Number Percent 06/30/17 3,638 88.5% 473 11.5% 4,111 06/30/18 2,770 86.4% 435 13.6% 3,205 253 55.0% 207 45.0% 460 6,661 85.7% 1,115 14.3% 7,776 06/30/19^ Total ^ - Through August 15, 2018. 12 Total By comparing the number of submitted fingerprint cards as recorded in PIPSBE to the number of nationwide background checks for which the FBI billed DCI, we determined the number of submitted fingerprint cards recorded in PIPSBE was overstated and not reliable. Table 4 compares the number of submitted fingerprint cards recorded in PIPSBE to the number of nationwide background checks for which the FBI billed DCI. Table 4 Number of Fiscal Year Ended Fingerprint Cards Submitted^ Fingerprint Cards Processed by FBI Variance 3,638 2,770 253 6,661 910 931 118 1,959 2,728 1,839 135 4,702 06/30/17 06/30/18 06/30/19* Total ^ - As recorded in the PIPSBE system. * - Through August 15, 2018. Corrective Action Taken by DPS – The Automatic Fingerprint Identification System (AFIS) is a database which includes personal identification information, such as social security number and date of birth, for individuals for whom a nationwide background check has been performed by an authorized agency at some point in time. As implied by the name, a fingerprint card has been processed for each individual included in AFIS. According to the former Bureau Chief of the Program Services Bureau, with assistance from available staff, he compiled a spreadsheet of licensees from PIPSBE for whom data was not included in AFIS. The spreadsheet was created after Mr. Sheehan was placed on administrative leave to identify a population of individuals for whom a nationwide background check needed to be performed. The population identified by DPS included 5,443 individuals which were listed on the spreadsheet DPS provided to us. We were unable to verify the accuracy of the information recorded on the spreadsheet. According to the former Bureau Chief, he began submitting fingerprint cards to the FBI in batches of 100 for the 5,443 individuals listed on the spreadsheet. However, after starting to submit the fingerprint cards, he determined it would be more efficient to submit fingerprint cards only for the license holders who were still employed by a licensed agency. As a result, the former Bureau Chief and available DPS staff contacted employing agencies to obtain a listing of current employees. Using the listing of current employees, DPS staff categorized the individuals on the spreadsheet as currently employed by a licensed agency or not. In accordance with guidance from the former DPS Commissioner, the currently employed licensees listed on the spreadsheet were prioritized for performance of a nationwide background check. Table 5 was prepared using information from the spreadsheet provided to us by DPS. Table 5 Number of Individuals on DPS Spreadsheet Description Cleared Revoked Voided Not cleared Total Employed Not Employed Total 3,022 65 3,087 20 - 20 - 1,223 1,223 1,113 - 1,113 4,155 1,288 5,443 13 As illustrated by the Table, the spreadsheet provided by DPS showed 4,155 licensees were currently employed and 1,288 were not currently employed by a licensed employer. As nationwide background checks were performed for the individuals listed on the spreadsheet, some licensees were determined to be “cleared” for a license or their license was revoked or voided. The revoked description was used for individuals currently employed for whom an infraction was identified which disqualified them from eligibility for a license. The voided description was used for individuals who were not eligible for a license because they were no longer employed by a licensed agency. As illustrated by the Table, 65 of the licensees who were not currently employed by a licensed agency were classified as “cleared” on the spreadsheet even though they were not eligible for a license. According to the former Bureau Chief, national background checks were performed for these individuals prior to determining which licensees were currently employed. However, he also stated all 1,288 licenses were voided on PIPSBE for the individuals who were not currently working for a licensed agency. Also as illustrated by Table 5, the spreadsheet provided to us by DPS staff showed 3,022 additional licensees tested were cleared, 20 licenses were revoked, and 1,223 licenses were voided. The remaining 1,113 licensees were classified as “not cleared.” Based on the information recorded in the spreadsheet and discussion with the former Bureau Chief, fingerprint cards were submitted to the FBI for 617 of the 1,113 licensees; however, background checks could not be completed for these individuals because the quality of the fingerprints on the cards submitted was not sufficient. In addition, fingerprint cards were not submitted to the FBI for the last 496 licensees because a fingerprint card could not readily be located at DPS for these individuals. According to the former Bureau Chief, he was instructed not to contact the 1,113 licensees to obtain replacement fingerprint cards due to the on-going investigation. According to DPS staff we spoke with, fingerprint cards are not currently being submitted to the FBI for these individuals. As a result, based on the information on the spreadsheet, DPS staff had not determined if the 1,113 licensees are eligible for a license at the time the former Bureau Chief left DPS employment. The former Bureau Chief reported he notified licensees regarding revocation of their licenses when DPS learned the licensee had not passed the nationwide background check. The former Bureau Chief also reported he notified the agencies/employers listed on the licenses. However, according to DPS staff we spoke with, they were instructed after the former Bureau Chief’s departure not to proceed with verifications. A DPS official reported he obtained an updated listing of valid licensees from PIPSBE and information from AFIS in early August 2019. He also reported he determined 869 of the individuals listed in PIPSBE with valid licenses were not listed in AFIS. As a result, the validity of the 869 licenses was still pending in August 2019. Because the 869 licensees identified are not included in AFIS, the DPS official reported it may be necessary to obtain fingerprint cards in order to perform background checks for them. We reviewed and concur with the methodology used by the DPS official to identify the 869 licensees who need further testing. However, we are not able to verify the population initially selected from PIPSBE. Because PIPSBE data changes as new information is updated within the system and the historical information is no longer available, we are unable to reperform the steps necessary to identify all individuals with a valid license on the date the DPS official obtained the data he used for testing. In addition, current DPS staff stated prior to the former Bureau Chief’s departure, he created a spreadsheet to track all collections. According to DPS staff, the spreadsheet has been maintained; however, it is not reconciled to drawdown accounts, other collections received, or other supporting documentation. 14 Recommended Control Procedures As part of our investigation, we reviewed the procedures used by the Department of Public Safety’s (DPS) Program Services Bureau to process receipts and issue guard cards. An important aspect of internal control is to establish procedures which provide accountability for assets susceptible to loss from error and irregularities. These procedures provide the actions of one individual will act as a check on those of another and provide a level of assurance errors or irregularities will be identified within a reasonable time during the course of normal operations. Based on our findings and observations detailed below, the following recommendations are made to strengthen the Bureau’s internal controls. A. Segregation of Duties – An important aspect of internal control is the segregation of duties among individuals to prevent one person from handling duties which are incompatible. The following internal control weaknesses were noted: (1) Opening mail, collecting funds, and processing draw down transactions were completed by the same person. (2) Independent verification of blank applications and unissued guard cards was not performed. (3) Applications were not consistently logged when purchased by agencies. (4) An independent review of applications received compared to guard cards issued was not completed. (5) A reconciliation of all funds received at the department was not completed. Recommendation – We realize segregation of duties is difficult with a limited number of staff. However, the duties within each function listed above should be segregated between Bureau staff. In addition to the draw down account reconciliations that are performed on a monthly basis, a reconciliation of all checks, money orders, and cash received by the Bureau should be performed. DPS officials should also ensure someone in a supervisory capacity periodically reviews PIPSBE data to identify instances where guard cards were issued but performance of a background check is not recorded. Supervisory staff should also periodically compare information recorded in PIPSBE for licensees to reports obtained from the FBI or AFIS to ensure data is accurately recorded in PIPSBE. B. Supporting Documentation – Limited records were maintained by the Bureau for guard cards during the period of our investigation. The following concerns were identified:  An initial receipt listing or comparable records were not prepared or maintained.  Subsequent disposition of pre-numbered applications was not documented, such as who the application was provided to, whether the application was received and the date received, and whether the application was approved, denied, or not returned.  Collections deposited were not coded in a manner which allowed the program for which a card was issued to be identified (i.e. private investigator, private security, or bail enforcement.).  Records were not maintained for collections received from individuals and agencies which did not pay from an established drawdown account. Prior to the former Bureau Chief’s departure, he created a spreadsheet to track all collections. According to DPS staff, the spreadsheet has been maintained; however, it is 15 not reconciled to drawdown accounts, other collections received, or other supporting documentation. Recommendation – DPS officials should ensure the Bureau establishes formal policies and procedures to account for all collections. Records should include:  Initial receipt listing or comparable records for all collections.  A listing of all pre-numbered applications documenting the name of the applicant, date received, and whether the application was approved, denied, or not returned.  Adequate supporting documentation for collections, including receipts.  Reconciliations performed on a routine basis between collections and applications processed in PIPSBE system.  All amounts deposited should be coded in a consistent manner which distinguishes the program. C. Software/Databases – During our testing, we identified incomplete/inaccurate data fields in PIPSBE system. Recommendation – DPS officials should perform periodic checks of data fields to ensure the PIPSBE data is complete and accurate. D. Applications – Applications are provided at a cost of $10.00 or $15.00. Some of the applications are submitted immediately after purchase, some are submitted at a later date, and some have yet to be submitted. The applications are prenumbered and the application numbers are also used as the guard card numbers. During our review, we determined DPS officials were not accounting for numerical sequence of the applications. As a result, DPS officials were unable to determine if the application was ever returned and if it was returned, whether it was for a private investigator, private security, and/or bail enforcement license. Recommendation – DPS officials should consider extending the application numbers to create unique control numbers in order to properly track provisional and active guard cards. In addition, the extended license numbers should include the type of license, such as private investigator, private security, and/or bail enforcements, and the status of the license, such as provisional, approved or denied. A unique control number, which uses the application number as it base, would allow DPS the ability to readily identify:  The number of applications received;  Fiscal year the application was received;  Pending applications that DPS has received payment for, but not processed;  Applications which were not returned to DPS for processing (based on age);  Denied applications;  Provisional licenses;  Revoked licenses;  Active licenses; For each of the data points listed above, DPS would be able to readily identify separate populations for private investigator, private security, and bail enforcement applications 16 and licenses. In addition, the information would assist DPS officials in analytically determining if all collections for a specific type of license had been properly recorded and deposited. E. Drawdown Accounts – During our review, we determined agencies were permitted to establish drawdown accounts for which application fees are automatically withdrawn rather than submitting a payment for each application. However, we identified the following concerns:  DPS did not establish procedures to provide periodic statements of activity in the drawdown accounts to the agencies holding the accounts. As a result, they are unable to verify accuracy of transactions recorded in the accounts or monitor the account balances.  Not all deposits and withdrawals are recorded in the drawdown accounts. As a result, processing payments are inconsistent.  A tracking mechanism is not in place to verify all drawdowns were properly recorded. Recommendation – DPS officials should ensure formal policies and procedures are implemented for the establishment and maintenance of drawdown accounts. The policies and procedures should include providing periodic statements to the agencies showing the activity in their drawdown accounts. In addition, DPS should implement a tracking mechanism to ensure all drawdowns are properly recorded and supporting documentation is maintained to identify when the drawdown occurred, the purpose of the drawdown, and who performed the drawdown. F. Guard Cards – During our review, we determined guard cards had been issued without the appropriate nationwide background check and/or improperly recorded on PIPSBE as having submitted and/or received nationwide background checks. Specifically, we identified the following:  5,817 guard cards were issued between July 1, 2016 and August 15, 2018 for which a nationwide background check was not completed. Because the proper procedures were not followed, we were unable to determine if any of the 5,817 guard cards issued without a nationwide background check would have been denied.  4,702 cards were improperly recorded on PIPSBE as fingerprint cards were submitted for testing. After determining guard cards had been improperly issued, DPS started correction action by performing nationwide background checks for certain individuals. However, corrective action has not been take for all individuals identified. We also determined denied or revoked guard cards were not returned to the Administrative Services Division in accordance with section 661-121.9(80A). In addition, we determined guard cards do not have an expiration date. Therefore, a licensee will maintain an active license until the applicant leaves employment of the agency specified on their license or the employer notifies DPS officials of any violations which can result in revocation of the license. Recommendation – Because guard cards do not expire, DPS officials should continue performing background checks for licensees who were not included in AFIS or perform the research necessary for the individuals identified as “not cleared” on the spreadsheet compiled by DPS staff. 17 As previously stated, DPS officials should also ensure dates for fingerprint card submission and date of the nationwide background check is properly recorded in the PIPSBE system. In addition, DPS officials should establish a process to ensure denied or revoked guard cards are returned in a timely manner by the employing agencies. DPS officials should also consider assessing agencies a fee when they do not return denied or revoked cards to DPS within a reasonable timeframe after being notified a guard card has been revoked. In order to ensure compliance with DPS requirements for a valid private investigator, private security, and/or bail enforcement license, DPS officials should consider implementing policies or procedures to establish an expiration date for individual licenses. Periodic reapplication for licenses would allow DPS to review the current eligibility of applicants. 18 Report on Special Investigation of the Department of Public Safety 19 Exhibit 20 Report on Special Investigation of the Department of Public Safety Number of Applications Processed by Fiscal Year For the Period July 1, 2016 through August 15, 2018 Fingerprint Cards Submitted Fiscal Year 06/30/17 Description Yes* No Fiscal Year 06/30/18 Total Yes* No Total Number of Guard Cards: Valid 1,936 269 2,205 2,176 333 2,509 Void 1,699 202 1,901 593 101 694 Revoked 2 1 3 1 1 2 Suspended 1 1 2 Guard cards issued 3,638 473 4,111 Denied applications - 91 91 564 4,202 Total applications 3,638 - - - 2,770 435 3,205 - 100 100 2,770 535 3,305 * - Yes in the PIPSBE system indicates a fingerprint card was submitted to the DCI to process the national background check. ^ - Through August 15, 2018 21 Exhibit A per PIPSBE System Fiscal Year 06/30/19^ Yes* No Total Total Yes* No Total 238 197 435 4,350 799 5,149 15 10 25 2,307 313 2,620 - - - 3 2 5 - - - 1 1 2 253 207 460 6,661 1,115 7,776 6 6 197 197 213 466 1,312 7,973 253 6,661 22 Report on Special Investigation of the Department of Public Safety Staff This special investigation was performed by: Melissa J. Finestead, CFE, Manager Crystal D. Jimenez-Boender, Staff Auditor Annette K. Campbell, CPA Deputy Auditor of State 23